CDK Global cyberattack still crippling car dealers

CBS News

1 Jul 202404:57

Summary

TLDRFollowing a major cyberattack on CDK Global, a software provider for car dealerships, many businesses are still struggling to operate fully, reverting to manual processes. The ransomware attack on June 19th has led to an estimated financial loss of at least $944 million due to business interruptions. Experts suggest that recovering from such intrusions can take weeks to months, emphasizing the need for businesses to focus on multifactor authentication, system patching, and proactive defense measures to harden against future attacks.

Takeaways

🚨 A major cyberattack on CDK Global, a company providing software for car dealerships, has caused significant operational disruptions.
⏱️ Recovery from the ransomware attack is expected to take weeks to months, which is common for enterprise-wide intrusions.
🔒 The process involves ensuring the threat actor no longer has access, investigating the breach, and recovering systems.
💡 Hardening the environment to prevent re-hack is as important as recovery, emphasizing the need for robust security measures.
💸 The estimated financial loss from the outage could be at least $944 million due to business interruptions over the first three weeks.
📈 Extortion operations targeting organizations in the United States are frequent, with ransomware a common method to demand payments.
🏥 There has been an increase in targeted attacks against healthcare organizations, indicating a shift in threat actor focus.
🛡️ Multifactor authentication is crucial for defending networks against unauthorized access.
🔄 Regular patching of systems and software is critical to maintaining security and preventing intrusions.
🕵️‍♂️ Engaging ethical hackers to test network defenses before threat actors can exploit vulnerabilities is recommended.
🎯 Businesses should assume a level of intrusion and build defensive controls to minimize the impact of an attack on operations.

Q & A

What major event occurred nearly two weeks prior to the script's recording?
-A major cyberattack on a company that provides software for car dealerships took place.
Which company was affected by the cyberattack?
-CDK Global was the company affected by the ransomware attack.
What systems does CDK Global provide for car dealerships?
-CDK Global provides systems to help run operations, manage inventory, and handle customer relations.
Why have some car dealerships had to revert to using paper and pen?
-Due to the cyberattack on CDK Global, many car dealerships are not fully functioning and had to revert to manual processes.
What was the expected date for the systems to be back to normal operations?
-The systems were expected to be back by July 4th.
What is the estimated financial loss from the outage over the first three weeks?
-The estimated financial loss from the outage is at least $944 million due to business interruptions.
Why does it take several weeks to recover from an enterprise-wide intrusion?
-It takes time to ensure the threat actor no longer has access, perform investigative work, recover systems, and harden the environment to prevent re-intrusion.
What is the common pattern in extortion operations against organizations in the United States?
-Extortion operations often involve the deployment of ransomware and the demand for extortion payments from threat actors.
Which sectors have been targeted by threat actors in recent attacks?
-Sectors such as healthcare, supply chain organizations, and banking have been targeted.
What is the role of Charles Carmichael in the context of this discussion?
-Charles Carmichael is a consultant from the organization of Google Cloud, discussing the cyberattack and recovery process.
What are some fundamental measures businesses can take to harden their targets against cyber threats?
-Businesses should focus on multifactor authentication, engaging ethical hackers to test defenses, patching systems and software, and building defensive controls and visibility across the environment.
Are there certain types of businesses that are more likely to be targeted by threat actors?
-Threat actors are opportunistic and target any organization capable of paying multimillion-dollar demands, but there has been a noticeable increase in targeted attacks against healthcare organizations.

Outlines

00:00

🛑 Impact of Cyberattack on Car Dealerships

A major cyberattack on CDK Global, a software provider for car dealerships, has left many businesses partially non-functional for nearly two weeks. The company relies on CDK Global for operational systems, inventory, and customer relations. Following the ransomware attack on June 19th, some dealerships have had to revert to manual processes with paper and pen. The company anticipates being back online by July 4th and estimates financial losses from the outage to be at least $944 million due to business interruptions over the first three weeks. Charles Carmichael, from Google Cloud, discusses the commonality of such extended recovery times for enterprise-wide intrusions, the investigative work required to ensure the threat actor no longer has access, and the process of hardening the environment to prevent re-hacking.

Mindmap

Keywords

💡Cyberattack

A cyberattack refers to any attempt to gain unauthorized access to a computer, server, or network to cause damage, steal sensitive data, or disrupt normal operations. In the video's context, a major cyberattack on a company providing software for car dealerships has caused significant operational disruptions, illustrating the severity and impact of such incidents on businesses.

💡CDK Global

CDK Global is a company that provides software solutions for car dealerships, aiding in the management of operations, inventory, and customer relations. The script highlights that a ransomware attack on CDK Global has affected many dealerships, emphasizing the reliance of businesses on such software providers for critical functions.

💡Ransomware

Ransomware is a type of malicious software that encrypts a victim's data and demands payment to restore access. The script mentions a 'ransomware attack,' indicating the specific nature of the cyberattack that has impacted CDK Global and, by extension, the car dealerships that rely on their services.

💡Business Interruption

Business interruption refers to the halt or disruption of normal business activities, often due to unforeseen events. The script discusses the financial losses estimated at $944 million due to business interruptions caused by the cyberattack, highlighting the economic impact of such events.

💡Recovery Time

Recovery time in the context of a cyberattack is the period required to restore systems and operations to normal after an incident. The script notes that it is common for organizations to take several weeks to a few months to recover from enterprise-wide intrusions, indicating the complexity and time-consuming nature of post-attack recovery.

💡Threat Actor

A threat actor is an individual or group that poses a threat to an organization's security, often by attempting unauthorized access or carrying out cyberattacks. The script mentions ensuring that the 'threat actor no longer has access to the environment,' which is a critical step in the recovery process after a cyberattack.

💡Hardening

Hardening, in cybersecurity, refers to the process of securing a system or network by reducing its vulnerability to attacks. The script suggests that organizations need to 'harden' their environments to prevent re-hacking, which involves implementing stronger security measures.

💡Extortion

Extortion is the act of obtaining money or other benefits by threat or force. In the context of the script, extortion operations are conducted against organizations, often through ransomware attacks, where threat actors demand payment in exchange for not disrupting business operations or releasing sensitive data.

💡Multifactor Authentication

Multifactor authentication is a security system that requires more than one method of verification to access a resource. The script points out the importance of multifactor authentication for defending networks against unauthorized access, suggesting it as a fundamental security measure.

💡Patch

In the context of cybersecurity, a patch is a piece of software designed to fix problems or vulnerabilities in a system. The script emphasizes the critical importance of patching systems and software to prevent exploitation by threat actors.

💡Healthcare Organizations

Healthcare organizations are mentioned in the script as targets of more targeted attacks in recent months. This highlights the sector as particularly vulnerable to cyberattacks, possibly due to the sensitive nature of the data they hold and the critical need for uninterrupted services.

Highlights

A major cyberattack on a company that provides software for car dealerships has left many not fully functioning nearly two weeks after the incident.

The affected company, CDK Global, provides systems for operations, inventory, and customer relations to car dealerships.

Since the ransomware attack on June 19th, some car dealers have had to revert to using paper and pen due to system outages.

CDK Global expects to be back to full functionality by July 4th.

The estimated financial losses from the outage could be at least $944 million due to business interruptions over the first three weeks.

Charles Carmichael from Google Cloud Consulting discusses the challenges of recovering from enterprise-wide intrusions.

Recovery from such cyberattacks can take several weeks to a few months.

Ensuring that the threat actor no longer has access to the environment is a crucial part of the recovery process.

Investigative work is needed to understand how the intrusion occurred and to ensure the threat actor does not retain access.

Systems and environments must be recovered to continue business operations, which can take weeks.

Hardening the environment to prevent re-hacking is a critical final step in the recovery process.

Extortion operations are common against US organizations, with many involving ransomware and extortion demands.

Attacks have targeted healthcare, supply chain, banking, and other sectors, with threat actors seeking multimillion-dollar demands.

The increasing sophistication of threat actors is a continuous challenge, but defensive measures are also improving.

Law enforcement actions may help decrease the number of intrusions over time.

Businesses should focus on fundamentals like multifactor authentication, engaging ethical hackers, patching systems, and building defensive controls.

Any organization can be a target for extortion, but healthcare has seen more targeted attacks recently.